Question on mail forwarding , 2 of 2

[Tim Wayne]

NOTE: PLEASE READ PART ONE OF THIS MESSAGE FIRST.

Begin forwarded message:
From: SpamCop AutoResponder <***@devnull.spamcop.net>
Date: May 15, 2006 4:38:45 PM PDT
To: ***@hisnameistimmy.com
Subject: [SpamCop] Errors encountered

SpamCop encountered errors while saving spam for processing:
SpamCop could not find your spam message in this email:

Return-Path: <***@yahoo.no>
Received: from sc-smtp2-bulkmx.soma.ironport.com (sc-smtp2-
bulkmx.soma.ironport.com [204.15.82.125])
by sc-app1.soma.ironport.com (Postfix) with ESMTP id DD52A1A707
for <***@spam.spamcop.net>; Mon, 15 May 2006
09:37:41 -0700 (PDT)
Received: from studio321.studio32.com ([128.121.51.87])
by sc-smtp2-bulkmx.soma.ironport.com with ESMTP; 15 May 2006
09:37:41 -0700
Received: from yahoo.no ([219.155.31.145])
by studio321.studio32.com (8.13.6/8.12.6) with ESMTP id k4FGbbNu098558
for <***@hisnameistimmy.com>; Mon, 15 May 2006 09:37:39
-0700 (PDT)
(envelope-from ***@yahoo.no)
Received: from unknown (HELO nntp.pinxodet.net) (Tue, 16 May 2006
04:26:33 +1100)
by smtp-server1.cfdenselr.com with ASMTP; Tue, 16 May 2006 04:26:33
+1100
Received: from unknown (HELO mail.gimmicc.net) (Tue, 16 May 2006
04:07:44 +1100)
by mx.reskind.net with LOCAL; Tue, 16 May 2006 04:07:44 +1100
Message-ID: <***@yahoo.no>
Date: Tue, 16 May 2006 03:45:45 +1100
From: "Ms" <***@yahoo.no>
MIME-Version: 1.0
To: "Postmaster" <***@hisnameistimmy.com>
Subject: Message for Tammy Lord 5.25%
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit


Hi,

Our Office has recei ved your filled app.

http://geocities.com/InaThayer7914

Please check the site above, Our office shall then re-confirm your info.

With Ref to: Tammy Lord

and your past track reco rd is not a factor.

All reefin ance types have been Ap pro ve d for you Tammy Lord

say never: http://geocities.com/RondaPelletier2462/a.htm

Best Regards,

Ms

The email which triggered this auto-response had the following headers:
Return-Path: <***@yahoo.no>
Received: from sc-smtp2-bulkmx.soma.ironport.com (sc-smtp2-
bulkmx.soma.ironport.com [204.15.82.125])
by sc-app1.soma.ironport.com (Postfix) with ESMTP id DD52A1A707
for <***@spam.spamcop.net>; Mon, 15 May 2006
09:37:41 -0700 (PDT)
Received: from studio321.studio32.com ([128.121.51.87])
by sc-smtp2-bulkmx.soma.ironport.com with ESMTP; 15 May 2006
09:37:41 -0700
Received: from yahoo.no ([219.155.31.145])
by studio321.studio32.com (8.13.6/8.12.6) with ESMTP id k4FGbbNu098558
for <***@hisnameistimmy.com>; Mon, 15 May 2006 09:37:39
-0700 (PDT)
(envelope-from ***@yahoo.no)
Received: from unknown (HELO nntp.pinxodet.net) (Tue, 16 May 2006
04:26:33 +1100)
by smtp-server1.cfdenselr.com with ASMTP; Tue, 16 May 2006 04:26:33
+1100
Received: from unknown (HELO mail.gimmicc.net) (Tue, 16 May 2006
04:07:44 +1100)
by mx.reskind.net with LOCAL; Tue, 16 May 2006 04:07:44 +1100
Message-ID: <***@yahoo.no>
Date: Tue, 16 May 2006 03:45:45 +1100
From: "Ms" <***@yahoo.no>
MIME-Version: 1.0
To: "Postmaster" <***@hisnameistimmy.com>
Subject: Message for Tammy Lord 5.25%
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit

[Mike Easter]

Post by Tim Wayne
NOTE: PLEASE READ PART ONE OF THIS MESSAGE FIRST.

There are several problems with trying to communicate your forwarding
problem by this method.

- posting a news message with your newsreader causes the header lines
to become 'mangled' compared to their original condition.
- you are exposing your submit address to the public. That unique code
for you needs to be kept a secret

Headerlines must be 'perfectly' configured, in which the fieldname colon
space fieldvalue starts every line, except for those lines which are
properly configured with leading whitespaces according to the rules of
wrapping fieldvalues with leading whitespace. When you paste headers
into the newsmessage, that formatting is manged. The body is also
mangled by adding linewraps which weren't previously there, but that is
less consequential.

After you get this problem worked out, it would be advisable to get a
new authorization code, because it is /possible/ - but unlikely - that
someone might choose to nefariously create bogus reports to cause
trouble by using your submit address code.

That being said, I'll suggest that you 'imagine' how the SC parser works
on a spam which you have forwarded to the parser by forwarding as an
attachment to a 'normal' mail addressed to the submit.

The normal submit consists of your headers to submit, followed by some
empty line representing the first part of the body, and typically
followed by some attachment MIME structure.

The parser 'automatically' removes the headers from you to the submit
and also automatically removes the MIME attachment structure so that it
can 'find' the beginning of the spam headers. Then, the parser parses
the headers 'line by line' until it gets to the end of the spam's
headers and finds the empty line representing the body, and then it
begins to parse the body.

If you forward a spam, the first thing that hits the parser is the
headers of the spam with your own forwarding lines appended to the top.
If SC 'subtracts' the headers from you to the submit, there are no
headers left.

[Mike Easter]

Post by Mike Easter
- posting a news message with your newsreader causes the header lines
to become 'mangled' compared to their original condition.

I see that you posted a news message to an nntp newsgroup by using a
mailuser agent through the mailing list and Mailman instead of a news
agent, but the problems of the mail agent mangling the example of the
mail's headers by introducing spurious wraps is exactly the same problem
as if it had been done by an nntp news agent.